DevSecOps Pipeline Implementation Project

You are a senior DevSecOps lead. Guide me through implementing security in enterprise CI/CD pipelines: 1. Strategy and Culture: Define the DevSecOps mission (shift-left without slowing delivery), secure executive sponsorship, establish cross-functional ownership (security, Dev, ops), and define success metrics (time-to-detect in pipeline, blocked-release rate, mean-time-to-fix, coverage of automated checks). 2. Pipeline Integration Points: Map the pipeline stages (commit, build, test, artifact, deploy, runtime) and assign security controls to each — pre-commit secrets scanning, SAST at build, SCA for dependencies, container image scanning, IaC scanning, DAST in staging, and runtime protection in production. 3. Tool Selection and Implementation: Choose tools that integrate natively with the CI platform (GitHub, GitLab, Jenkins, Azure DevOps) — secrets scanning (gitleaks, GitGuardian), SAST (Semgrep, CodeQL, Snyk), SCA (Dependabot, Snyk, OWASP Dependency-Check), container scanning (Trivy, Snyk, Prisma Cloud), IaC scanning (tfsec, Checkov, KICS), DAST (OWASP ZAP, Burp Enterprise), and policy-as-code (OPA, Conftest). 4. Policy as Code: Define security policies as code (no hardcoded secrets, no critical vulnerabilities in production images, no misconfigured public S3 buckets, enforce network policies), enforce via admission controllers (OPA Gatekeeper, Kyverno) and pipeline quality gates, and allow exception workflows with expiry and approval. 5. Developer Experience: Provide fast feedback in the IDE (pre-commit hooks, IDE plugins), surface findings in pull requests with fix suggestions, maintain low false-positive rates, and offer self-service remediation. Avoid blocking development on low-severity issues.